Start with your URL
Get a first look at the scripts and behavior on your public storefront.
Available nowStart with the public storefront
Keep selling.
Put security on autopilot.
Find threats across your storefront, apps, and webhooks. Fix them automatically. Keep watch around the clock.
Start with your store URL. No sales call.
Your store, under a continuous watch.
Illustrative preview with sample data.
More than a theme scan.
Harmful code can arrive through a theme, a storefront app, or a connection you forgot about. rootscan follows the places it can reach.
Catch the code that shouldn’t be there.
Watch your theme, checkout flows, and front-end apps for skimmers, injected scripts, data forwarding, and errors that disrupt shopping.
- Malware and code that intercepts customer input
- Suspicious redirects and unexpected data destinations
- Script changes that break storefront behavior
Example signalReview
A storefront script is forwarding form data.
Theme assets / checkout-helper.js- Before
- Customer input stays in the intended flow
- Observed
- Data sent to an unexpected host
Trace the script, preserve a snapshot, and remove the injected code where access and policy allow.
Illustrative example · Synthetic dataAn app should only get what it needs.
Review excessive permissions, unexplained access, and backdoor indicators using the app and account evidence you connect.
- Permissions that exceed an app’s purpose
- Unauthorized or unexplained access pathways
- Suspicious behavior from connected apps
Example signalReview
An app’s access no longer fits its job.
Connected evidence / App access review- Before
- A storefront widget needs display access
- Observed
- Customer-data access also requested
Review the evidence and revoke unnecessary access through the supported merchant controls.
Illustrative example · Synthetic dataKnow where your store is sending data.
Inspect the webhook endpoints and integrations in your connected scope. Look for unsafe destinations, weak verification, and exposed secrets.
- Unexpected destinations for store or customer data
- Missing sender verification and exposed credentials
- Changes to supported webhook connections
Example signalReview
A connected webhook points somewhere new.
Order events / Delivery destination- Before
- An approved integration endpoint
- Observed
- An unfamiliar external destination
Confirm the recipient, review verification, and repair the supported configuration.
Illustrative example · Synthetic dataAutonomous fixing
Finding it is the start.
Fixing it is the point.
Let rootscan handle supported fixes within your rules. It keeps a snapshot, makes the change, and checks the result. Anything outside your policy comes back to you.
A way backRestore points before supported changes.
A working siteCheck pages, forms, and shopping flows.
Your approval rulesUncertain or sensitive changes wait for you.
Sample repairReady to preview
A threat found. A store still running.
Theme assets / checkout-helper.jsSave a snapshot
Keep a copy of the affected theme asset.
Apply the approved fix
Remove the verified injected script.
Check the storefront
Verify the affected shopping flows.
Resume protection
Keep watching, with rollback available.
See the steps from a finding to a verified fix.
Interactive example. No live site is changed.
Maintained dailyAttack patterns change.
Attack patterns change.
So do our checks.
A growing attack-pattern library helps rootscan recognize familiar threats and pick up new ones. Daily updates feed the next scan.
Pattern matching finds the signal. Investigation adds the context before a fix.
Attack-pattern libraryExample families
Skimmers & injected code
Form interception, hidden payloads, and altered storefront scripts.
Data theft & redirects
Unexpected forwarding, suspicious destinations, and malicious navigation.
Access abuse & backdoors
Excessive permissions and access that does not fit the intended job.
Webhook & integration risks
Unsafe endpoints, weak verification, and exposed credentials.
One store. One place to start.
From a first look to continuous protection, without a sales call.
Connect for deeper protection
Authorize Shopify and supported integrations. Choose what rootscan can inspect and fix.
Let protection keep running
New scans, daily threat updates, and verified fixes as your store changes.
You review the connection before granting access.
Good questions.
Straight answers.
The scope, the fixes, and the control you keep.
How is this different from Shopify’s own security?
Shopify protects its platform. rootscan focuses on the code, apps, permissions, and connections around your store: what changed, where data is going, and what needs fixing.
Can I start with just my store URL?
Yes. Start with the public storefront. Connect Shopify and any supported integrations when you want deeper visibility and supported fixes. You review the requested permissions before connecting.
What can rootscan fix automatically?
Supported, reversible changes that you authorize in your protection policy, such as repairing accessible theme assets or removing verified injected code. Changes outside that policy wait for approval. Each fix keeps a snapshot and is checked afterward.
Can it see every app permission and webhook?
Coverage follows the access and evidence you connect. Shopify does not expose every third-party app’s private permissions, secrets, or webhook subscriptions to another app. rootscan shows the scope behind a finding rather than assuming complete visibility.
How does continuous protection work?
Recurring scans, storefront behavior checks, supported Shopify events, and comparisons against saved baselines work together. New attack patterns are added to the detection library daily.
What if a fix affects the store?
Every supported change has a restore point. Validation checks the affected storefront flows; a failed check should stop the change or restore the previous state. Sensitive actions can be kept behind your approval.
Do I need a security team?
No. The dashboard explains what rootscan found, what it changed, and what still needs your decision. You can share the evidence with your developer when a change needs their help.
Get back to running your store.
Check your storefront. Choose what happens next.
Running WordPress instead?
Find vulnerable plugins. Patch carefully. Keep the site working.